How to send a whole error message to Graylog with nxlog(im_file)

Hello,

I need to send log messages from a text file to graylog, for this I am using nxlog and im_file input module, but if error occurs graylog is receiving each line in an error message as new entry on Graylog web UI and that to each line is not complete one(it is getting just half of the line and missing some line the total error message).

Here is my nxlog config for text file(im_file) input

Module im_file
File ‘D:\Temp\Log.txt’
PollInterval 1
SavePos True
ReadFromLast True
Recursive False
RenameCheck False
Exec $FileName = file_name(); # Send file name with each message

output file:

Module om_tcp

Host graylog_server_IP

Port 12201

OutputType GELF_TCP

Do i need to make any changes in input or output configuration in order to get whole error message in a single entry on Graylog?
I am receiving multiple entries like below for a single error on a text file(on server)

here is actual error i have on text file, i need to see this whole error message on graylog with single entry, How can I achieve this? can someone please suggest me.

[Exception]
2020-01-30 10:14:21,968 [46] ERROR NoelLevitz.R3.Dashboard.Web.MvcApplication -
Request failed during /Student/GetGroupActionData/8235/3/?isInclude=true&sortColumnName=LastName&sortColumnDirection=asc&searchValue=&toggleAll=false&totalRecordCount=145
Ajax display call failed

System.NotSupportedException: Unable to create a null constant value of type 'System.Collections.Generic.List1'. Only entity types, enumeration types or primitive types are supported in this context. at System.Data.Objects.ELinq.ExpressionConverter.ConstantTranslator.TypedTranslate(ExpressionConverter parent, ConstantExpression linq) at System.Data.Objects.ELinq.ExpressionConverter.TranslateExpression(Expression linq) at System.Data.Objects.ELinq.ExpressionConverter.MethodCallTranslator.ContainsTranslator.TranslateContains(ExpressionConverter parent, Expression sourceExpression, Expression valueExpression) at System.Data.Objects.ELinq.ExpressionConverter.MethodCallTranslator.TypedTranslate(ExpressionConverter parent, MethodCallExpression linq) at System.Data.Objects.ELinq.ExpressionConverter.TranslateExpression(Expression linq) at System.Data.Objects.ELinq.ExpressionConverter.TranslateLambda(LambdaExpression lambda, DbExpression input) at System.Data.Objects.ELinq.ExpressionConverter.MethodCallTranslator.OneLambdaTranslator.Translate(ExpressionConverter parent, MethodCallExpression call, DbExpression& source, DbExpressionBinding& sourceBinding, DbExpression& lambda) at System.Data.Objects.ELinq.ExpressionConverter.MethodCallTranslator.OneLambdaTranslator.Translate(ExpressionConverter parent, MethodCallExpression call) at System.Data.Objects.ELinq.ExpressionConverter.MethodCallTranslator.TypedTranslate(ExpressionConverter parent, MethodCallExpression linq) at System.Data.Objects.ELinq.ExpressionConverter.TranslateExpression(Expression linq) at System.Data.Objects.ELinq.ExpressionConverter.MethodCallTranslator.OneLambdaTranslator.Translate(ExpressionConverter parent, MethodCallExpression call, DbExpression& source, DbExpressionBinding& sourceBinding, DbExpression& lambda) at System.Data.Objects.ELinq.ExpressionConverter.MethodCallTranslator.SelectTranslator.Translate(ExpressionConverter parent, MethodCallExpression call) at System.Data.Objects.ELinq.ExpressionConverter.MethodCallTranslator.TypedTranslate(ExpressionConverter parent, MethodCallExpression linq) at System.Data.Objects.ELinq.ExpressionConverter.TranslateExpression(Expression linq) at System.Data.Objects.ELinq.ExpressionConverter.MethodCallTranslator.OneLambdaTranslator.Translate(ExpressionConverter parent, MethodCallExpression call, DbExpression& source, DbExpressionBinding& sourceBinding, DbExpression& lambda) at System.Data.Objects.ELinq.ExpressionConverter.MethodCallTranslator.OneLambdaTranslator.Translate(ExpressionConverter parent, MethodCallExpression call) at System.Data.Objects.ELinq.ExpressionConverter.MethodCallTranslator.TypedTranslate(ExpressionConverter parent, MethodCallExpression linq) at System.Data.Objects.ELinq.ExpressionConverter.TranslateExpression(Expression linq) at System.Data.Objects.ELinq.ExpressionConverter.Convert() at System.Data.Objects.ELinq.ELinqQueryState.GetExecutionPlan(Nullable1 forMergeOption)
at System.Data.Objects.ObjectQuery1.GetResults(Nullable1 forMergeOption)
at System.Data.Objects.ObjectQuery1.System.Collections.Generic.IEnumerable<T>.GetEnumerator() at System.Collections.Generic.List1…ctor(IEnumerable1 collection) at System.Linq.Enumerable.ToList[TSource](IEnumerable1 source)
at NoelLevitz.R3.Dashboard.Business.Services.StudentService.FilterExistingStudentListBySurveyCompleted(List1 selectedInstitutionStudentSurveyIds) in C:\TFS\R3\Dev\Dashboard\NoelLevitz.R3.Dashboard.Business\Services\StudentService.cs:line 146 at NoelLevitz.R3.Dashboard.Web.Controllers.StudentController.GetGroupActionData(Int32 id, Boolean isInclude, String sortColumnName, String sortColumnDirection, String searchValue, List1 students, Boolean toggleAll, Int32 totalRecordCount) in C:\TFS\R3\Dev\Dashboard\NoelLevitz.R3.Dashboard.Web\Controllers\StudentController.cs:line 678
at lambda_method(Closure , ControllerBase , Object )
at System.Web.Mvc.ReflectedActionDescriptor.Execute(ControllerContext controllerContext, IDictionary2 parameters) at System.Web.Mvc.ControllerActionInvoker.InvokeActionMethod(ControllerContext controllerContext, ActionDescriptor actionDescriptor, IDictionary2 parameters)
at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass42.b__41()
at System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethod(IAsyncResult asyncResult)
at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass37.<>c__DisplayClass39.b__33()
at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass4f.b__49()

Input:

Module im_file File 'D:\Temp\\Log.txt' PollInterval 1 SavePos True ReadFromLast True Recursive False RenameCheck False Exec $FileName = file_name(); # Send file name with each message

Output:

Module om_tcp

Host graylog_server_ip

Port 12201

OutputType GELF_TCP

HI, dheeraj9

Don’t focus on configuring input to Graylg, especially with NXLog
Better to use a Filebeat
Send all text to Graylg
Then inside the Graylg tool (Alert, Extractor, …) try to delete those duplicates and just see the Errors section

Thanks for your response Bahram!

I am trying to send logs from a windows server to graylog, in addition to .NET application text logs, I need to get windows event logs and IIS logs as well. With filebeat input can I get above all type of logs to Graylog? Or do
I need to use winlogbeat for windows servers and filebeat for linux servers??

Thanks,

Dheeraj

hi

OK , ( for windows use winlogbeat and for linux filebeat )
These two links can be very helpful to you
https://www.elastic.co/guide/en/beats/winlogbeat/current/index.html
AND
https://www.elastic.co/guide/en/beats/filebeat/current/index.html

good luck :wink:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.